PT-2025-51929 · Churchcrm · Churchcrm

Xy20130630 · Publicado 2025-12-17 · Atualizado 2025-12-20 · CVE-2025-68111

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3

Description ChurchCRM is an open-source church management system. A SQL injection issue exists in the eGive.php file within the "ReImport" functionality. An authenticated user with finance privileges can execute arbitrary SQL queries by manipulating the MissingEgive FamID ... POST parameter. This can lead to unauthorized data access, modification, or deletion within the database.

Recommendations Update to version 6.5.3 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-68111

GHSA-C4VM-87VF-HMX9

Produtos afetados

Churchcrm

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68111.json · Exploit
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-c4vm-87vf-hmx9 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2002487817272963400 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-68111 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-68111 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2001460011495575978 · Publicação no Twitter